Global Account Administration

A global account ships with Global Account Administrator, Global Account Viewer, and Directory Admin role collections. What does the presence of Directory Admin tell you about how you should scope someone's access?

A subaccount's only administrator just went on emergency leave and no one else can manage it. From the global account, what is the fastest legitimate way to get yourself in, and what is the catch?

You grant someone the Global Account Administrator role collection just so they can manage quotas. What did you actually hand them, and why is that a problem?

A colleague says putting BTP admin accounts on an unrelated domain like domain1.dev is just mailbox-hygiene housekeeping. Why is that wrong, and what is the domain choice actually defending against?

You need direct SAML trust configuration for BTP. Can you set it up at the global account level, and if not, where does it have to go?

When would you reach for System Landscape in a global account rather than the resource-provider or subaccount tooling?

You're connecting an SAP cloud system to the global account under System Landscape. After clicking Get Token, what step is easy to forget that leaves the trust half-built?

Which resource-provider use cases does SAP BTP currently support?

You're grouping a handful of similar subaccounts under a directory. Should you pick a simple directory or a managed one?

What's the real reason SAP says to keep at least two global account administrators, beyond the obvious vacation-coverage answer?

What are the typical steps of a booster wizard, in order?

You need a custom permission set in a global account. Can you author a new single (individual) role from scratch?

How can you tell at a glance whether a given directory is managed or just a simple structuring directory?

Your break-glass (emergency access) account shows a login or password-reset attempt you didn't make. What's the prescribed response, and what's the weaker move people default to?

What does a booster actually do for you in SAP BTP, and what does it NOT do once it finishes?

You've connected your global account admins via Identity Authentication with 2FA. What does SAP say to do with SAP ID, and why is leaving it on dangerous?

When does it make sense to use a resource provider in SAP BTP rather than provisioning the resource through BTP itself?

Should your application developers be granted global account access in SAP BTP?

Someone needs to inspect a managed directory's configuration but must not change anything. Which of the two directory role collections do you give them?

You discover your organization has more than one global account. Is that a setup mistake, and how does it happen?

Can you stack multiple managed directories within a single directory hierarchy to layer inherited permissions?

A teammate bookmarked hana.ondemand.com years ago and insists that's the dead old address for BTP. What actually happens if they use it, and how do you reach a specific region's cockpit directly?

Right after a brand-new global account is provisioned, nobody has configured Identity Authentication yet — so who can actually get in and start administering it?

You type a new admin's email into Create under Security • Users, it saves fine, but they still can't log on. What requirement about that email is easy to miss?

You choose Create • Directory and the screen looks bare — no option to make it a managed directory and nowhere to set the parent. What did you skip, and where does 'managed' actually get decided?

You've created directories but your subaccounts are still sitting loose at the top of the Account Explorer. How do you actually file them into a directory, and how can you see the tree when it gets busy?

You want to give someone admin rights over just one branch of subaccounts without touching the global account. What capability must the directory have, and how are the users you create there different from global-account users?

You're about to pick a data-residency region and can only find that setting on subaccounts, not on the global account. Is the cockpit hiding it, or is that by design?

Your organization just bought more SAP BTP licenses and a developer asks where they get 'plugged in' so a subaccount can use them. What layer owns that, and what do you do there?

An admin's S-user suddenly stops working in the global account while their colleague's P-user keeps going. What's the likely cause, and what's the maintenance trap?

A booster's Success screen appears and you assume you still have to go build the runtime and app by hand. What has it actually already provisioned for you, and where do you verify it?